Hardware Security Modules safenet / thales

[jd456]

here are some PCI-E part numbers avalable on ebay
there are also dedicated servers avalable with these plugged in also avalable.

SafeNet VBD-05

Safenet VBD-04-0103
Safenet 834-04005-002
Thales nshield solo nCipher Thales A-022001-L

linux user guide for newer ncipher cards

https://www.club.cc.cmu.edu/~ajo/disseminate/nShield_Solo_Edge_User_Guide_Unix.pdf

datasheet for older cards (in pic)

https://www.ictsecurity.com.au/wp-content/uploads/2018/02/nshield-solo-datasheet.pdf

user guide

(PDF) nShield Solo XC F3 & nShield Solo XC F3 for nShield ......nShield Solo XC F3 & nShield Solo XC F3 for nShield Connect XC and for nShield Issuance HSM Page 9 of 40 2.2 Keys and Critical - DOKUMEN.TIPS

nShield Solo XC F3 nShield Solo XC F3 for nShield Connect XC and for nShield Issuance HSM Non-proprietary Security Policy for FIPS 140-2 Level 2 Page 2 of 40 nShield Solo…

dokumen.tips

SUN Oracle 375-3424-06 CMN 3010 Crypto Accelerator ( x6000a )

manual from ~ 2007

https://www.oracle.com/technetwork/topics/security/140sp778-160926.pdf

Download Sun Oracle Sun Crypto Accelerator 6000 Board User Manual | ManualsLib

www.manualslib.com

These are extremley expensive new but avalable on ebay rather cheaply these days, and could be intresting to play with. Does anyone here run a CA from these?

I am struggling to find goof information on these, the ones on ebay all seem to be older models that have been purchased by thales and no longer sold so better documentation is found in the internet archive.

Has anyone experience using these in a professional or homelab conext? Does anyone know about the software, API and liscencing issues with them? Any advice?

 

[cesmith9999]

15 years ago I worked with a few like these. You need to have at least 3 of them in 3 different servers. This is so you can change out one of the cards if a card goes bad. and not lose the cipher/certificate.

The servers that I worked with were placed in a security cage with secure racks in them to reduce physical access.

Usually these were set them and forget them scenario. not much to play with, There is other software that interfaces with Apache/Windows IIS to make it run correctly.

Chris